2

The Issue:

I have two interfaces, vlan.202 and tap0. vlan.202 is my VLAN for VPN clients and originally I just used to tunnel all my VPN clients onto a random subnet and have them share my host IP, but I would like to actually have my clients tunnel in and be dumped unto the VPN clients VLAN. This server I am working on is NOT the primary router and is just a server with a link to the VLAN. I want to do this so all clients are forced to talk to my router and cant router to other VLANs by using my servers routing table.

In a nutshell, I want to bridge the interfaces without any IPs on the server on that VLAN. I just want my clients to be dumped onto the VLAN as if a hub was there. (Just taking all packets received on one interface and putting them on the other.)


What I have tried:

I am still very new to IP Tables, but I have literally spent 8+ hours at this point.

  • I tried creating a forwarding rule that would just take an input interface and jump it to an output, but the rule was never hit since there was no IP and that packets were targetting me as their gateway.
  • I tried playing with input and output chains as well but had no luck.
  • I tried creating new chains as seen below to allow me to input and output but they failed to accomplish the goal as well.

My OpenVPN Server Config:

; Connection Details
local 10.10.3.2
port 25000
;proto tcp
proto udp
dev tap0
;dev tun

; Keys & Certs
ca ca.crt
cert SP.crt
key SP.key
dh dh4096.pem
tls-auth ta.key 0

; Subnet for Clients
server-bridge 10.20.8.1 255.255.255.0 10.20.8.2 10.20.8.254
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"

keepalive 10 120

; Encryption Settings
cipher AES-256-CBC
auth SHA256

; Compression Settings
;compress lz4-v2
;push "compress lz4-v2"

max-clients 10

; Security Settings to Avoid Attacks
user nobody
group nogroup

persist-key
persist-tun

; Logging
status /var/log/openvpn/openvpn-status.log
;log         /var/log/openvpn/openvpn.log
log-append  /var/log/openvpn/openvpn.log
verb 3
;mute 20

My IP Table Config:

# START OPENVPN RULES
# Mangle table rules
*mangle
:PREROUTING ACCEPT [0:0]
# Custom Chains
-N V202
-A V202 -i tap0 -o vlan.202 -g POSTROUTING
-N TAP
-A TAP -i vlan.202 -o tap0 -g POSTROUTING
# TAP <-> vlan.202
-A PREROUTING -i vlan.202 -g TAP
-A PREROUTING -i tap0 -g V202
COMMIT
# END OPENVPN RULES
  • @user535733 It would defeat the purpose for me to use routing tables as then all VPN clients could speak directly on the server and bypass and rules or filters I may be adding down the road. – Sean Mitchell Feb 5 at 2:32
0

I may be wrong but it sounds as if you're trying to locally route remote VPN clients' traffic among each other and other hosts on the VLAN.

If so, then because you're trying to route traffic, routing must be enabled. So, unless it's already been done, edit /etc/sysctl.conf and add or uncomment the following line:

net.ipv4.ip_forward=1

Then either reboot or run:

sudo sysctl -p

Second, the INPUT and OUTPUT chains are only for packets destined for a local process or socket (meaning the host), and not for packets destined for another system. For the latter, use the FORWARD chain. Also, the filter table is likely a better location than mangle.

Third, -j may be better than -g for your case.

I haven't tested this, and can't intelligently comment on whether implementing a TUN interface might be a better approach, but to forward packets from tap to vlan.202 I might suggest:

iptables -A FORWARD -i tap -o vlan.202 -j ACCEPT

To go the other way:

iptables -A FORWARD -i vlan.202 -o tap -j ACCEPT

To route packets among systems on the vlan (if not otherwise accomplished):

iptables -A FORWARD -i vlan.202 -o vlan.202 -j ACCEPT

To route packets among systems on tap (again, if not otherwise accomplished):

iptables -A FORWARD -i tap -o tap -j ACCEPT

You can refine these rules by source, destination, protocol, and port, of course.

Also, these rules will not persist through a reboot, so you'll need to use iptables-save and iptables-restore in startup scripts, or incorporate the above iptables commands in a script that runs at startup. An example of a systemd .service file that calls a script (named iptables-rules.sh) at startup is:

# /etc/systemd/system/iptables-rules.service

[Unit]
Description=Run iptables rules at startup
Before=network-online.target

[Service]
Type=oneshot
ExecStart=/bin/bash -c /etc/my-scripts/iptables-rules.sh

[Install]
WantedBy=multi-user.target

Other sources cover how to write and save a script (syntax is easy; be sure to set the file as executable using chmod) and how to enable a .service.

Good luck and HTH.

| improve this answer | |
  • I have tried something like that. All I really need to do is plug two interfaces into eachother. One physical and one virtual. – Sean Mitchell Feb 9 at 15:54
  • Understood. Your virtual bridge/switch solution above does just that, and the same also can be done with Netplan or systemd-networkd. Either way, all the systems are on the same subnet. The routing solution I describe can address cases involving multiple subnets, which VLAN configurations often have, and can filter traffic in any event, which a bridge/switch can't. Which is better is just a question of requirements, and simpler is always better. – ebsf Feb 9 at 23:47
  • Thank you anyway though, I do honestly like the IP Table solution a bit more, but it doesn't really like to work unless IPs are involved. I think I am just gonna deal with the bridge and maybe someday down the road when I am not so busy, take another crack at it since IP Tables should be able to do this kinda stuff. – Sean Mitchell Feb 11 at 13:44
0

Found it! I wanted to avoid bridges using IPs, but not necessarily bridges. I was able to fix this using a script I downloaded and edited to the following:

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

echo "Making tunnel..."
openvpn --mktun --dev tap0

echo "Creating bridge..."
brctl addbr bridge0
brctl addif bridge0 vlan.202
brctl setageing bridge0 0

echo "Adding tap interface to bridge"
brctl addif bridge0 tap0

echo "Setting tap rules..."
ifconfig tap0 0.0.0.0 promisc up
iptables -A INPUT -i tap0 -j ACCEPT

echo "Setting bridge rules"
iptables -A INPUT -i bridge0 -j ACCEPT
iptables -A FORWARD -i bridge0 -j ACCEPT

echo "Bringing up interface as promisc"
ifconfig vlan.202 0.0.0.0 promisc up

echo "Bringing up bridge"
ifconfig bridge0 up

It effectively makes a bridge that behaves like a hub.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.